跳转到正文
HMAC

HMAC 生成器

用 Web Crypto 生成 HMAC-SHA-256 / SHA-512。

在浏览器内运行 — 数据不会离开您的设备

HMAC signs a message with a shared secret for integrity. Computed in-browser via Web Crypto (HMAC-SHA-256 / SHA-512)—key and message never leave your device.

关于HMAC 生成器

HMAC (Hash-based Message Authentication Code) authenticates a message with a shared secret—common for webhooks, API request signing, and debugging HS* JWTs. toco.tools computes HMAC-SHA-256 and HMAC-SHA-512 via the Web Crypto SubtleCrypto API entirely in your browser. Keys and messages accept UTF-8 or hex bytes; output is hex (lower/upper) or Base64, with optional verify against an expected value. Secrets never leave the device. In production verification, use constant-time compares and protect your keys.

使用方法

  1. Choose SHA-256 or SHA-512
  2. Enter secret key and message
  3. Copy the HMAC or verify against an expected value

常见问题

How does HMAC differ from a plain hash?

A hash digests data alone. HMAC mixes in a shared secret so only parties who know the key can produce the same signature.

Are the key or message sent to a server?

No. Everything is computed in your browser with Web Crypto.

Can I use an empty key?

No. Major browsers reject zero-length HMAC keys in Web Crypto—provide at least one byte.